p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de oro/customer-portal

Vulnerabilidades publicadas para oro/customer-portal en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 2

  1. CVE-2023-48296

    Media · CVSS 4.3EPSS 0,44%Corrección disponible

    OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID

    OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4.

    oro/customer-portal oro/customer-portal oro/customer-portal oro/customer-portalPHP
    • Actualiza a 5.1.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2023-32064

    Media · CVSS 5EPSS 0,5%Corrección disponible

    OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility

    OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1.

    oro/customer-portal oro/customer-portal oro/customer-portalPHP
    • Actualiza a 5.0.11
    • Actualiza a 5.1.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →